Commit 7008b939 authored by YannGarcia's avatar YannGarcia
Browse files

Support of implicit certificates step2: Sending message signed by implicit certificate

parent 4456ec71

ccsrc/Externals/LibItsSecurity_externals.cc

+0 −26
Original line number Diff line number Diff line
@@ -2062,32 +2062,6 @@ namespace LibItsSecurity__Functions { 
    return TRUE;

  }



  BOOLEAN fx__reconstructPublicKeyNistP256__test(

                                                 const OCTETSTRING &p__cert__to__be__signed, 

                                                 const OCTETSTRING &p__issuer__public__key__x,

                                                 const OCTETSTRING &p__issuer__public__key__y,

                                                 const OCTETSTRING &p__reconstruct__public__key__compressed,

                                                 const INTEGER &p__compressedMode,

                                                 OCTETSTRING &p__public__key__x, 

                                                 OCTETSTRING &p__public__key__y, 

                                                 OCTETSTRING &p__public__key__compressed,

                                                 INTEGER &p__public__key__compressed_mode

                                                 ) {

    loggers::get_instance().log_msg(">>> fx__reconstructPublicKeyNistP256__test: p__cert__to__be__signed: ", p__cert__to__be__signed);

    loggers::get_instance().log_msg(">>> fx__reconstructPublicKeyNistP256__test: p__issuer__public__key__x: ", p__issuer__public__key__x);

    loggers::get_instance().log_msg(">>> fx__reconstructPublicKeyNistP256__test: p__issuer__public__key__y: ", p__issuer__public__key__y);

    loggers::get_instance().log_msg(">>> fx__reconstructPublicKeyNistP256__test: p__reconstruct__public__key__compressed: ", p__reconstruct__public__key__compressed);

    loggers::get_instance().log_msg(">>> fx__reconstructPublicKeyNistP256__test: p__compressedMode: ", p__compressedMode);



    // Create reconstruction key

    security_ecc ecc(ec_elliptic_curves::nist_p_256, p__reconstruct__public__key__compressed, (p__compressedMode == 0) ? ecc_compressed_mode::compressed_y_0 : ecc_compressed_mode::compressed_y_1);

    if (ecc.reconstruct_public_keys(p__cert__to__be__signed, p__issuer__public__key__x, p__issuer__public__key__y, p__public__key__x, p__public__key__y, p__public__key__compressed, p__public__key__compressed_mode) == -1) {

      return FALSE;

    }

    

    return TRUE;

  }



  //        group geospacial



  /*          * \brief    Check that given polygon doesn't have neither self-intersections nor holes.

ccsrc/Protocols/Security/certificates_loader.cc

+6 −6
Original line number Diff line number Diff line
@@ -371,18 +371,18 @@ int certificates_loader::load_certificate(const OCTETSTRING& p_hashed_id8, const 
      loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Implicit issuer hash: ", m.cbegin()->second->hash_sha_256());

      OCTETSTRING input = hash_tbs + m.cbegin()->second->hash_sha_256();

      loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: input: ", input);

      sha.generate(input, hash_tbs);

      loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: joint hash: ", hash_tbs);

      // Reconstruction of the public key.

      OCTETSTRING public_key_x;       // public keys X-coordinate

      OCTETSTRING public_key_y;       // public keys Y-coordinate

      OCTETSTRING public_comp_key;    // public compressed key, 33 or 49 bytes length, byte #0 indicating compressed-y-0 (0x02) or compressed-y-1 (0x03)

      INTEGER public_comp_key_mode;   // public compressed key mode (02 or 03)

      {

      security_ecc r_key(algorithm, rv_key_x, rv_key_y); // Reconstruction key

        if (r_key.reconstruct_public_keys(input, static_cast<const OCTETSTRING&>(issuer_sign_key_x), static_cast<const OCTETSTRING&>(issuer_sign_key_y), public_key_x, public_key_y, public_comp_key, public_comp_key_mode) == -1) {

      if (r_key.reconstruct_public_keys(hash_tbs, static_cast<const OCTETSTRING&>(issuer_sign_key_x), static_cast<const OCTETSTRING&>(issuer_sign_key_y), public_key_x, public_key_y, public_comp_key, public_comp_key_mode) == -1) {

        loggers::get_instance().warning("certificates_loader::load_certificate: Failed to encode toBeSigned");

        return -1;       

      }

      }

      loggers::get_instance().log_msg("certificates_loader::load_certificate: public_key_x: ", public_key_x);

      loggers::get_instance().log_msg("certificates_loader::load_certificate: public_key_y: ", public_key_y);

      loggers::get_instance().log_msg("certificates_loader::load_certificate: public_comp_key: ", public_comp_key);

ccsrc/Protocols/Security/security_cache.cc

+0 −28
Original line number Diff line number Diff line
@@ -54,9 +54,7 @@ int security_cache::load_certificate(const std::string &p_certificate_id, const 
      loggers::get_instance().warning("security_cache::load_certificate: Failed to load certificate");

      return -1;

    } else {

      //it = _certificates.find(p_certificate_id);

      *p_record = _certificates[p_certificate_id].get();

      loggers::get_instance().log("security_cache::load_certificate: Added '%s'", (*p_record)->certificate_id().c_str());



     return 0;

    }
@@ -107,32 +105,6 @@ int security_cache::get_certificate(const std::string &p_certificate_id, Ieee160 
    return -1;

  }











  loggers::get_instance().log("security_cache::get_certificate (1): ######## algorithm: '%d'", record->signing_algorithm());

  loggers::get_instance().log("security_cache::get_certificate (1): ######## key: '%s'", record->certificate_id().c_str());

  loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## certificate: ", record->certificate());

  loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## decoded_certificate: ", record->decoded_certificate());

  loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## issuer: ", record->issuer());

  loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## hash: ", record->hash());

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## hash_sha_256: ", hash_sha_256);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## hashed_id: ", hashed_id);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## private_key: ", private_key);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_key_x: ", public_key_x);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_key_y: ", public_key_y);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_comp_key: ", public_comp_key);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## private_enc_key: ", private_enc_key);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_enc_key_x: ", public_enc_key_x);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_enc_key_y: ", public_enc_key_y);

      // loggers::get_instance().log_msg("security_cache::get_certificate (1): ######## public_enc_comp_key: ", public_enc_comp_key);









  //loggers::get_instance().log("<<< security_cache::get_certificate (1): Added '%s'", record->certificate_id().c_str());

  //loggers::get_instance().log_msg("security_cache::get_certificate (1): ", record->decoded_certificate());

  p_certificate = record->decoded_certificate();



  return 0;

ccsrc/Protocols/Security/security_ecc.cc

+12 −12
Original line number Diff line number Diff line
@@ -841,6 +841,7 @@ int security_ecc::sign(const OCTETSTRING &p_data, OCTETSTRING &p_r_sig, OCTETSTR 
    return -1;

  }

  loggers::get_instance().log("security_ecc::sign: succeed");

  loggers::get_instance().log_msg("security_ecc::sign: signing private key: ", _pri_key);



  if (::ECDSA_do_verify(static_cast<const unsigned char *>(p_data), p_data.lengthof(), signature, _ec_key) != 1) {

    loggers::get_instance().warning("security_ecc::sign: Signature not verified");
@@ -927,8 +928,8 @@ int security_ecc::sign(const OCTETSTRING &p_data, const OCTETSTRING &p_entl_a, c 
}



int security_ecc::sign_verif(const OCTETSTRING &p_data, const OCTETSTRING &p_signature) {

  loggers::get_instance().log(">>> security_ecc::sign_verif");

  loggers::get_instance().log_msg(">>> security_ecc::sign_verify: p_data: ", p_data);

  loggers::get_instance().log_msg(">>> security_ecc::sign_verify: p_signature: ", p_signature);



  // Sanity checks

  if (p_data.lengthof() == 0) {
@@ -951,8 +952,8 @@ int security_ecc::sign_verif(const OCTETSTRING &p_data, const OCTETSTRING &p_sig 
}



int security_ecc::sign_verif(const OCTETSTRING &p_data, const OCTETSTRING &p_entl_a, const OCTETSTRING &p_id, const OCTETSTRING &p_signature) {

  loggers::get_instance().log(">>> security_ecc::sign_verif");

  loggers::get_instance().log_msg(">>> security_ecc::sign_verify: p_data: ", p_data);

  loggers::get_instance().log_msg(">>> security_ecc::sign_verify (1): p_data: ", p_data);

  loggers::get_instance().log_msg(">>> security_ecc::sign_verify (1): p_signature: ", p_signature);



  // Sanity checks

  if (p_data.lengthof() == 0) {
@@ -961,11 +962,11 @@ int security_ecc::sign_verif(const OCTETSTRING &p_data, const OCTETSTRING &p_ent 


  // Build the signature

  BIGNUM *r = ::BN_bin2bn(static_cast<const unsigned char *>(p_signature), p_signature.lengthof() / 2, nullptr);

  loggers::get_instance().log_to_hexa("security_ecc::sign_verify: r=", static_cast<const unsigned char *>(p_signature), p_signature.lengthof() / 2);

  loggers::get_instance().log_to_hexa("security_ecc::sign_verify (1): r=", static_cast<const unsigned char *>(p_signature), p_signature.lengthof() / 2);

  BIGNUM *s = ::BN_bin2bn(static_cast<const unsigned char *>(p_signature) + p_signature.lengthof() / 2, p_signature.lengthof() / 2, nullptr);

  loggers::get_instance().log_to_hexa("security_ecc::sign_verify: s=", static_cast<const unsigned char *>(p_signature) + p_signature.lengthof() / 2,

  loggers::get_instance().log_to_hexa("security_ecc::sign_verify (1): s=", static_cast<const unsigned char *>(p_signature) + p_signature.lengthof() / 2,

                                      p_signature.lengthof() / 2);



  // FIXME FSCOM

  //loggers::get_instance().log("security_ecc::sign_verif: %s", (result == 1) ? "succeed" : "failed");

  //return (result == 1) ? 0 : -1;

  return -1;
@@ -984,17 +985,16 @@ int security_ecc::reconstruct_public_keys(const OCTETSTRING &p_cert_to_be_signed 
  if (fsize != p_issuer_public_key_x.lengthof()) {

    loggers::get_instance().warning("security_ecc::reconstruct_public_keys: key size mismatch");

    return -1;

  }

  if (fsize != p_cert_to_be_signed.lengthof()) {

    loggers::get_instance().warning("security_ecc::reconstruct_public_keys: input hash size mismatch");

    return -1;

  }

	bn_print("security_ecc::reconstruct_public_keys: order=", ::EC_GROUP_get0_order(_ec_group));

	bn_print("security_ecc::reconstruct_public_keys: order=", ::EC_GROUP_get0_cofactor(_ec_group));



	BIGNUM* H = ::BN_new();

  OCTETSTRING input = p_cert_to_be_signed + ((_pub_key_compressed_mode == ecc_compressed_mode::compressed_y_0) ? int2oct(2, 1) : int2oct(3, 1)) + _pub_key_compressed;

  sha256 sha;

  OCTETSTRING hash_input;

  sha.generate(input, hash_input);

  loggers::get_instance().log_msg("security_ecc::reconstruct_public_keys: hash_input=", hash_input);

  ::BN_bin2bn(static_cast<const unsigned char*>(hash_input), fsize, H);

  ::BN_bin2bn(static_cast<const unsigned char*>(p_cert_to_be_signed), fsize, H);

	//bn_print("security_ecc::reconstruct_public_keys: H(1)=", H);

	::BN_rshift1(H, H); // h: leftmost floor(log_2 n) bits of p_cert_to_be_signed

	//bn_print("security_ecc::reconstruct_public_keys: H(2)=", H);

etc/AtsSecurity/AtsSecurity.cfg

+1 −1
Original line number Diff line number Diff line
@@ -152,7 +152,7 @@ system.camUtPort.params := "UT_CAM/UDP(dst_ip=192.168.1.43,dst_port=12345,src_po 


# --------------------- IMPILICT CERT ---------------------

# Check that IUT supports usage of implicit certificate for signing message

ItsSecurity_TestCases.TC_SEC_ITSS_RCV_IMPLICIT_CERT_01_BV

ItsSecurity_TestCases.TC_SEC_ITSS_SND_IMPLICIT_CERT_01_BV



# Check that IUT accepts a valid secured CAM message signed with implicit certificate

#ItsSecurity_TestCases.TC_SEC_ITSS_SND_IMPLICIT_CERT_01_BV